Washington SaaS Terms: A Drafting Checklist with Washington-Specific Overlays
SaaS terms of service are mostly a contract-drafting exercise: subscription mechanics, acceptable use, IP, warranty disclaimer, liability cap, dispute resolution. Washington adds three statutory overlays that any SaaS company selling into Washington should understand: the Consumer Protection Act in Chapter 19.86 RCW, the My Health My Data Act in Chapter 19.373 RCW, and the data breach notification statute in Chapter 19.255 RCW. This guide walks through the drafting checklist with the Washington overlays called out where they actually change the analysis.
Ask my AI Legal Analyst about Washington consumer health data and MHMDA?
Tap a question for an instant, free answer (no email needed), or describe your product and the analyst routes you to the right next step.
Common Washington consumer-health-data questions, always free
Quick answer
A SaaS terms package selling into Washington should include solid baseline terms (subscription, auto-renewal, acceptable use, AI features, warranty disclaimer, liability cap, dispute resolution), and three Washington-specific overlays: a Consumer Protection Act risk review of marketing and auto-renewal practices, a My Health My Data Act analysis if the product touches any consumer health data, and an incident response plan tied to Chapter 19.255 RCW.
SaaS terms drafting checklist
1. Subscription and auto-renewal
- Clear billing cadence (monthly, annual, multi-year) with stated price.
- Auto-renewal disclosure: how renewal happens, what notice is given, how the user cancels, and the cancellation deadline relative to the renewal date.
- Pro-rata or no-refund policy on mid-term cancellation, clearly stated.
- Price-increase mechanism on renewal with advance notice.
2. Acceptable use
- Prohibited content (illegal, infringing, defamatory, malware, child sexual abuse material per federal law).
- Prohibited conduct (interference with the service, automated scraping outside published APIs, reverse engineering).
- Account suspension and termination rights for breach.
- Cooperation with lawful process and platform safety obligations.
3. Data processing
- Clear delineation of controller and processor roles (or business and service provider under California law).
- Data processing addendum (DPA) for B2B customers handling personal data.
- Sub-processor list and notice mechanism.
- Cross-border transfer mechanism where applicable.
- Customer audit rights, scoped to be workable for a SaaS provider.
4. AI features
- Clear disclosure that AI features may produce inaccurate, incomplete, or misleading output.
- User obligation to verify AI output before relying on it.
- Training data policy: whether customer inputs and outputs are used for model training, with opt-out for B2B.
- IP ownership of AI-generated output, with appropriate carve-outs and disclaimers.
- If the product is used by lawyers, doctors, or other regulated professionals, layered disclaimers on practice-specific output.
5. User uploads and content
- User license to the SaaS provider to host, process, and display user content.
- User representation that they have the rights to upload the content.
- DMCA notice-and-takedown process for U.S. operations.
- Retention and deletion practices.
6. Warranty disclaimers
- "As is" and "as available" disclaimers.
- Disclaimer of merchantability, fitness for a particular purpose, and non-infringement, in CAPS or otherwise conspicuously displayed.
- Carve-out for any express service-level commitments the SaaS actually makes.
7. Liability cap
- Cap usually expressed as fees paid in the prior 12 months.
- Exclusion of indirect, consequential, special, incidental, and punitive damages.
- Carve-outs for indemnity obligations, IP infringement, confidentiality breach, and gross negligence or willful misconduct.
- Drafting note: an unconscionable cap can be invalidated, and a cap that purports to immunize a party from intentional misconduct is generally not enforceable.
8. Arbitration and dispute resolution
- Mandatory arbitration with a chosen forum and rules.
- Class action waiver.
- Mass arbitration protocol (batching, bellwether process).
- Carve-outs for small claims and equitable relief.
- 30-day informal dispute resolution period before arbitration.
9. Venue and governing law
- Choice of law (typically the SaaS provider's home state or a neutral commercial state like Delaware).
- Choice of forum.
- Note that consumer-protection statutes in the user's home state may still apply regardless of the chosen governing law.
10. Privacy interaction
The terms of service should reference the privacy policy and any data processing addendum. Conflicts between the documents are a fertile source of litigation, so use cross-references and one canonical version for each topic.
Washington overlay 1: Consumer Protection Act (Chapter 19.86 RCW)
The Washington Consumer Protection Act, Chapter 19.86 RCW, prohibits unfair or deceptive acts or practices in the conduct of any trade or commerce. The private cause of action under RCW 19.86.090 allows a successful plaintiff to recover actual damages, treble damages up to a statutory cap, attorney fees, and an injunction. The five elements of the private CPA claim (per Washington case law applying Hangman Ridge Training Stables v. Safeco Title Ins. Co.) are an unfair or deceptive act, in trade or commerce, that affects the public interest, causes injury to the plaintiff's business or property, and is causally linked.
For SaaS founders, the practical CPA exposures cluster around marketing claims that overstate features, hidden auto-renewal practices, dark-pattern cancellation flows, and material omissions in onboarding. The CPA is the enforcement vehicle the Washington Attorney General most often uses against consumer-facing SaaS practices, and it is also the private plaintiff's preferred theory because of the fee-shift and treble damages.
Washington overlay 2: My Health My Data Act (Chapter 19.373 RCW)
The Washington My Health My Data Act, Chapter 19.373 RCW, regulates the collection, use, sharing, and sale of consumer health data by regulated entities. It applies broadly to any consumer health data (not just HIPAA-covered data), and it covers a much wider universe of products than founders expect: wellness apps, fitness trackers, period and fertility trackers, mental health tools, AI symptom checkers, sleep apps, and any SaaS that infers health-related information from user inputs or device signals.
Key obligations under the Act include:
- Consumer health data privacy policy disclosures.
- Affirmative, opt-in consent before collecting or sharing consumer health data, with detailed disclosure of categories and purposes.
- Stricter "valid authorization" for any sale of consumer health data.
- Consumer rights of access, deletion, and withdrawal of consent.
- Restrictions on geofencing around health care facilities.
- A private right of action through the Consumer Protection Act for violations.
The private right of action through the CPA is the part most SaaS founders miss. A My Health My Data Act violation does not just trigger AG enforcement; it can also trigger CPA-style private litigation with fee-shifting and treble damages. If a product touches anything that could be characterized as health, wellness, fitness, mental health, or symptom-related data on Washington residents, this statute should be on the legal review list.
Washington overlay 3: Data breach notification (Chapter 19.255 RCW)
Washington's data breach notification statute, Chapter 19.255 RCW, imposes notification obligations when there is a breach of system security involving personal information of Washington residents. Key features that SaaS founders should bake into their incident response plan and customer contracts:
- A defined set of data categories qualifying as "personal information" under the statute.
- An encryption / secured-data safe harbor where the data was encrypted and the decryption mechanism was not also acquired.
- Consumer notice obligations on a defined timeline.
- Attorney General notification for breaches affecting more than 500 Washington residents, no more than 30 days after the breach is discovered.
- Defined content requirements for the AG notice.
For a full walkthrough of the statutory definitions, encryption safe harbor, timing, and the comparison to California's notification regime, see my Washington Data Breach Notification Guide.
Washington legal leverage
For a SaaS company selling into Washington, the highest-leverage drafting work is at the intersection of these three statutes. The CPA is a private fee-shifting statute with treble damages; the My Health My Data Act incorporates the CPA as its private enforcement vehicle; the data breach statute creates an AG notification obligation that almost always becomes public. A SaaS terms package that addresses all three with the actual statutory text in mind is materially more defensible than a generic SaaS template that ignores them.
SaaS founder checklist for Washington
- Terms of service drafted against the SaaS checklist above.
- Privacy policy that addresses Washington-resident rights and discloses any consumer health data collection.
- Auto-renewal flow reviewed against state and federal auto-renewal rules.
- Data processing addendum for any B2B customer handling personal data.
- Incident response plan with a documented AG notification path under Chapter 19.255 RCW.
- If health, wellness, or symptom-related data is in play: a My Health My Data Act compliance assessment, including consent flow, geofencing, and the valid authorization for any sale.
- Marketing review for CPA risk on any "no commitment," "cancel anytime," "free trial," or auto-renewal claims.
Service packages
Related resources
For SaaS-focused intake, see my SaaS contracts intake. For California parallels, see the California Privacy Hub and SaaS Legal Package Hub. For the breach-notification deep dive, see my Washington Data Breach Notification Guide. For more formation context, see the Washington Business Law hub.
Payment
Flat fee, paid up front through a secure PayPal checkout, so the budget is fixed before any work starts. The Written Attorney Consultation is a flat $240. There is no hourly meter and no surprise invoice. If a matter is unusually large or turns into extended negotiation, I tell you before any additional work and we agree on scope first.
Delivery
Drafts in 2 to 3 business days, even for complex agreements. I work weekends when a matter needs it and it is engaged. You receive the work product by email in an editable format, with brief written comments explaining the key issues and the reasoning behind the main choices.
Process
- Send the materials. Email me your current documents, screenshots, and a short description of the product and the Washington consumers it touches.
- I confirm scope and run a conflict check. Engagement begins only after that check and a written confirmation of what is included.
- I draft or review. You get the deliverable with plain-language comments on the highest-risk items first.
- We refine. Reasonable revision rounds are included so the final version fits how your product actually works.
Scope
This is attorney-supervised regulatory and document work under my California license: issue spotting, compliance planning, drafting, and review. It is not Washington court representation. For Washington filings, litigation, or any court appearance, I coordinate with Washington-admitted counsel. Nothing here creates an attorney-client relationship until a conflict check clears and an engagement is confirmed in writing.
Send your question, a short factual summary, and your key documents. You get a written attorney response identifying the main legal issues, the risks, and the practical next steps, so you know whether you have a real exposure and what to do about it. Provided under my California license; for Washington court representation I coordinate with Washington-admitted counsel.
See the full Washington MHMDA resource → or email me directly for a scoped quote.